users: refactor password reset flow.
The old password reset flow: * User requests a password reset. * Danbooru generates a password reset nonce. * Danbooru emails user a password reset confirmation link. * User follows link to password reset confirmation page. * The link contains a nonce authenticating the user. * User confirms password reset. * Danbooru resets user's password to a random string. * Danbooru emails user their new password in plaintext. The new password reset flow: * User requests a password reset. * Danbooru emails user a password reset link. * User follows link to password edit page. * The link contains a signed_user_id param authenticating the user. * User changes their own password.
This commit is contained in:
3
app/mailers/application_mailer.rb
Normal file
3
app/mailers/application_mailer.rb
Normal file
@@ -0,0 +1,3 @@
|
||||
class ApplicationMailer < ActionMailer::Base
|
||||
default from: "#{Danbooru.config.canonical_app_name} <#{Danbooru.config.contact_email}>", content_type: "text/html"
|
||||
end
|
||||
@@ -1,17 +0,0 @@
|
||||
module Maintenance
|
||||
module User
|
||||
class PasswordResetMailer < ActionMailer::Base
|
||||
def reset_request(user, nonce)
|
||||
@user = user
|
||||
@nonce = nonce
|
||||
mail(:to => @user.email, :subject => "#{Danbooru.config.app_name} password reset request", :from => Danbooru.config.contact_email)
|
||||
end
|
||||
|
||||
def confirmation(user, new_password)
|
||||
@user = user
|
||||
@new_password = new_password
|
||||
mail(:to => @user.email, :subject => "#{Danbooru.config.app_name} password reset confirmation", :from => Danbooru.config.contact_email)
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
@@ -1,10 +1,14 @@
|
||||
class UserMailer < ActionMailer::Base
|
||||
class UserMailer < ApplicationMailer
|
||||
add_template_helper ApplicationHelper
|
||||
add_template_helper UsersHelper
|
||||
default :from => Danbooru.config.contact_email, :content_type => "text/html"
|
||||
|
||||
def dmail_notice(dmail)
|
||||
@dmail = dmail
|
||||
mail(:to => "#{dmail.to.name} <#{dmail.to.email}>", :subject => "#{Danbooru.config.app_name} - Message received from #{dmail.from.name}")
|
||||
end
|
||||
|
||||
def password_reset(user)
|
||||
@user = user
|
||||
mail to: "#{@user.name} <#{@user.email}>", subject: "#{Danbooru.config.app_name} password reset request"
|
||||
end
|
||||
end
|
||||
|
||||
Reference in New Issue
Block a user